Prove every payment boundary.
Trust the contract, not the caller.
This is the public evidence surface for Ackrate's Mainnet enforcement layer. MandateRegistry checks the caller, merchant, asset, budget, expiry, status, and sequence before Circle USDC moves. The SDK, model, interface, payment header, merchant, and RPC are treated as untrusted inputs.
Complete evidence map
Six requirements. One inspectable chain.
Each node resolves to public source, a named test, a recorded gate result, or a reproduction path. Nothing on this page is a decorative pass state.
Contract surface
Public Registry and timelock functions are listed with their named tests or explicit invariants.
Inspect evidenceNegative paths
The suite covers unauthorized callers, expiry, overspend, replay, reentrancy, and upgrade attempts; 34 is the total Mainnet test count.
Inspect evidenceThreat model
Assets, trust assumptions, invariants, attack surfaces, mitigations, and stop conditions are explicit.
Inspect evidenceTrust boundaries
The mandate lifecycle, money path, failure recovery, and governed upgrade path are diagrammed.
Inspect evidenceDependency gate
The required workflow fails on actionable dependency or yanked-package findings; the latest run and versioned report are authoritative.
Inspect evidenceIndependent replay
An external reviewer can reproduce dependency checks, formatting, linting, contract tests, and portable WASM builds.
Inspect evidenceA release pipeline built to stop on doubt.
Ackrate's gate-check engine evaluates source identity, contract surface, hostile paths, dependencies, reproducible artifacts, and live chain state as one evidence chain. A mismatch at any stage stops the release.
Reviewed source identity is pinned before any release check begins.
Negative-path suite
Choose an attack path.
Each control below links to the exact Rust test that proves the contract response.
Published contract evidence
Unauthorized caller
A different key tries to spend under a valid mandate.
Rejected before value moves
MandateRegistry requires the stored agent authorization for every payment.
user_agent_and_revocation_authorizations_are_host_enforcedInspect source and snapshots Enforcement boundary
Everything outside the registry is untrusted.
The interface and agent may propose a payment. Only the on-chain transaction can authorize, consume, and settle it. Failed authorization, validation, allowance, or transfer reverts the complete invocation.
Proposes an exact merchant, asset, amount, and sequence.
Carries the challenge and proof; never becomes contract authority.
Re-reads durable state, authenticates, checks, consumes, then transfers.
Moves value only through the registry-bound allowance.
State and value change together—or neither changes.
Every payment re-reads the current on-chain mandate.
A paid receipt can recover delivery without paying twice.
Independent review trail
Start with the evidence, not the pitch.
Threat model
Protected assets, trust boundaries, invariants, attack paths, controls, and release stop conditions.
Open evidenceSecurity data flow
The complete mandate lifecycle, money path, trust boundaries, failure recovery, and governance flow.
Open evidenceGate-check results
34 total contract tests: 23 Registry tests, 11 TimelockController tests, plus dependency results and reproduction commands.
Open evidenceContinuous contract gate
Formatting, warnings-denied linting, dependency scanning, tests, and exact Mainnet artifact checks on every change.
Open evidenceDependency gate
Deployed contract graph is clear.
The previously detected vulnerable time package and yanked spin package were remediated. One accepted maintenance warning remains confined to host/test tooling; the gate fails if it enters either deployed WASM graph.
Source to chain
Exact identity, independently reproducible.
The manifest records source commits, artifact hashes, constructor values, contract state, deployment transactions, and the live contract identities used by the application.
Contract surface
The public contract surface is mapped.
Reads, mandate lifecycle calls, money-moving calls, emergency controls, policy changes, upgrades, and every timelock mutator are mapped to a named test or an explicit invariant in the threat model.
Inspect the function-by-function mapget_schema_version · is_paused · is_asset_allowed · get_mandateregister_mandate · revoke_mandate · execute_paymentpause · unpause · set_asset_allowedgrant_role · revoke_role · set_role_admin · upgradeschedule · execute · cancel · update_delaySDK perimeter
Useful clients. Zero financial authority.
These packages make the safe path clear, but none can approve its own payment. The registry authenticates and re-checks every value-moving request, even if a package, application, or model is modified.
Agent payment orchestration
Typed Stellar client
Mandate adapter
Fulfillment verifier
Operator tooling
Reproduce locally
One command. The same repository gate.
git clone https://github.com/ackrate/ackrate-protocol-contracts.git
cd ackrate-protocol-contracts
./scripts/security-scan.sh
cargo fmt --manifest-path contracts/mainnet/mandate-registry/Cargo.toml --all -- --check
cargo clippy --manifest-path contracts/mainnet/mandate-registry/Cargo.toml --all-targets -- -D warnings
cargo test --manifest-path contracts/mainnet/mandate-registry/Cargo.toml
cargo build --manifest-path contracts/mainnet/mandate-registry/Cargo.toml --target wasm32v1-none --release
cargo fmt --manifest-path contracts/mainnet/timelock-controller/Cargo.toml --all -- --check
cargo clippy --manifest-path contracts/mainnet/timelock-controller/Cargo.toml --all-targets -- -D warnings
cargo test --manifest-path contracts/mainnet/timelock-controller/Cargo.toml
cargo build --manifest-path contracts/mainnet/timelock-controller/Cargo.toml --target wasm32v1-none --releaseThis portable source gate checks dependencies, formatting, warnings-denied linting, all 34 Mainnet contract tests, and both WASM builds. The governed Mainnet workflow separately pins the release platform and verifies source, toolchain, interfaces, artifact hashes, provenance, and chain state.
Live authority
Two contracts. One governed path.
Run the gate. Follow every claim to source.
The repository is organized so an external reviewer can reproduce the test and dependency gates, inspect every contract function, verify the trust boundaries, and compare the governed source and artifacts with Mainnet.